Get a rule change-history event | Kibana API documentation

Get a rule change-history event Experimental; added in 9.5.0

GET /api/alerting/v2/rules/{id}/history/{eventId}

Spaces method and path for this operation:

get /s/{space_id}/api/alerting/v2/rules/{id}/history/{eventId}

Refer to Spaces for more information.

Get the full detail for a single rule change-history event, including the rule configuration snapshot.

[Required authorization] Route required privileges: read_alerting-v2-rules.

Path parameters

id string Required

The identifier for the rule.

Minimum length is 1, maximum length is 150.
eventId string Required

The change-history event identifier (event.id).

Minimum length is 1, maximum length is 150.

Responses

200 application/json

Returns the requested rule change-history event.
Hide response attributes Show response attributes object
- action string Required
- actor object Required
  
  Additional properties are NOT allowed.
  
  Hide actor attributes Show actor attributes object
  
  name string Required
  
  profileId string
- changes object
  
  Additional properties are NOT allowed.
  
  Hide changes attributes Show changes attributes object
  
  count integer Required
  
  Minimum value is 0, maximum value is 9007199254740991.
  
  summary object
  
  Additional properties are allowed.
- comment string
- id string Required
- isCurrent boolean
- metadata object
  
  Additional properties are allowed.
- reason string
- snapshot object Required
  
  Additional properties are allowed.
- tags array[string]
- timestamp string Required
400 application/json

Indicates the request failed schema validation.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
401 application/json

Indicates the request was not authenticated.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
403 application/json

Indicates the user does not have the required privileges to perform the request.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
404 application/json

Indicates a change-history event with the given ID does not exist.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
500 application/json

Indicates an unexpected server-side error.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
503 application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.

GET /api/alerting/v2/rules/{id}/history/{eventId}

curl \
 --request GET 'https://localhost:5601/api/alerting/v2/rules/{id}/history/{eventId}' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "action": "rule_update",
  "actor": {
    "name": "elastic",
    "profileId": "u_profile_1"
  },
  "changes": {
    "count": 1,
    "summary": {
      "metadata": {
        "name": "Host CPU high"
      }
    }
  },
  "id": "0194f0c8-aaaa-7bbb-8ccc-ddddeeeeffff",
  "isCurrent": true,
  "metadata": {
    "version": 2
  },
  "snapshot": {
    "created_at": "2026-01-15T12:00:00.000Z",
    "created_by": "elastic",
    "enabled": true,
    "grouping": {
      "fields": [
        "host.name"
      ]
    },
    "id": "rule-1",
    "kind": "alert",
    "metadata": {
      "description": "Alerts when average CPU usage exceeds a threshold.",
      "name": "Host CPU critical",
      "tags": [
        "production",
        "infra"
      ],
      "version": 2
    },
    "query": {
      "breach": {
        "query": "FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name"
      },
      "format": "standalone"
    },
    "recovery_strategy": "no_breach",
    "schedule": {
      "every": "1m",
      "lookback": "5m"
    },
    "state_transition": {
      "pending_count": 1,
      "recovering_count": 1
    },
    "time_field": "@timestamp",
    "updated_at": "2026-01-15T12:00:00.000Z",
    "updated_by": "elastic"
  },
  "timestamp": "2026-01-15T12:05:00.000Z"
}

Response examples (400)

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "errors": [],
      "properties": {
        "eventId": {
          "errors": [
            "Too small: expected string to have >=1 characters"
          ]
        }
      }
    }
  },
  "error": "Bad Request",
  "message": "eventId: Too small: expected string to have >=1 characters"
}

Response examples (401)

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

Response examples (403)

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

Response examples (404)

{
  "code": "RULE_CHANGE_NOT_FOUND",
  "details": {
    "event_id": "missing-event",
    "rule_id": "rule-1"
  },
  "error": "Not Found",
  "message": "Rule change with event id \"missing-event\" not found for rule \"rule-1\""
}

Response examples (500)

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

Response examples (503)

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}

{
  "code": "RULE_CHANGE_HISTORY_UNAVAILABLE",
  "error": "Service Unavailable",
  "message": "Rule change history is unavailable"
}